Skip to content
Fencer Vulns

live: new CVEs every 10 minutes, KEV hourly

Every vulnerability. One feed.

The CVE List, GitHub advisories, OSV, NVD, ENISA EUVD and distro advisories merged into one entry per vulnerability, flagged with what attackers actually use: CISA KEV, EPSS and public exploits.

Open the critical feed Check a lockfile

208 new in the last 24 hours, 37 critical in 7 days, 30 added to CISA KEV in 30 days.

new vulnerabilities per day, by severity 9 weeks
kev 74 critical 3,092 high 13,257 medium 12,852 low 1,538 unscored 2,331 Sep 8: 92 critical, 929 high, 514 medium, 33 low, 1 unscored; 4 added to CISA KEV Sep 9: 56 critical, 197 high, 354 medium, 49 low, 12 unscored; 4 added to CISA KEV Sep 10: 56 critical, 189 high, 136 medium, 6 low, 0 unscored; 2 added to CISA KEV Sep 11: 102 critical, 294 high, 137 medium, 12 low, 152 unscored; 4 added to CISA KEV Sep 12: 12 critical, 26 high, 52 medium, 4 low, 1 unscored Sep 13: 3 critical, 44 high, 58 medium, 27 low, 1 unscored Sep 14: 53 critical, 204 high, 357 medium, 65 low, 1 unscored; 1 added to CISA KEV Sep 15: 176 critical, 778 high, 302 medium, 36 low, 0 unscored Sep 16: 104 critical, 371 high, 241 medium, 26 low, 126 unscored; 3 added to CISA KEV Sep 17: 76 critical, 336 high, 142 medium, 26 low, 434 unscored Sep 18: 50 critical, 211 high, 222 medium, 45 low, 0 unscored; 3 added to CISA KEV Sep 19: 8 critical, 23 high, 64 medium, 9 low, 0 unscored Sep 20: 12 critical, 30 high, 48 medium, 15 low, 2 unscored Sep 21: 24 critical, 114 high, 128 medium, 18 low, 3 unscored; 1 added to CISA KEV Sep 22: 84 critical, 177 high, 181 medium, 15 low, 4 unscored; 4 added to CISA KEV Sep 23: 42 critical, 202 high, 228 medium, 33 low, 2 unscored Sep 24: 32 critical, 191 high, 157 medium, 17 low, 174 unscored; 2 added to CISA KEV Sep 25: 22 critical, 188 high, 216 medium, 14 low, 231 unscored; 3 added to CISA KEV Sep 26: 11 critical, 109 high, 113 medium, 11 low, 1 unscored Sep 27: 12 critical, 40 high, 56 medium, 12 low, 1 unscored; 2 added to CISA KEV Sep 28: 43 critical, 105 high, 149 medium, 16 low, 1 unscored Sep 29: 97 critical, 249 high, 232 medium, 41 low, 1 unscored; 1 added to CISA KEV Sep 30: 66 critical, 310 high, 246 medium, 26 low, 1 unscored; 1 added to CISA KEV Oct 1: 53 critical, 165 high, 159 medium, 18 low, 1 unscored; 1 added to CISA KEV Oct 2: 42 critical, 191 high, 174 medium, 10 low, 1 unscored; 2 added to CISA KEV Oct 3: 5 critical, 42 high, 60 medium, 7 low, 0 unscored Oct 4: 6 critical, 29 high, 22 medium, 6 low, 0 unscored; 1 added to CISA KEV Oct 5: 29 critical, 159 high, 207 medium, 22 low, 1 unscored Oct 6: 98 critical, 379 high, 357 medium, 32 low, 156 unscored Oct 7: 52 critical, 117 high, 174 medium, 11 low, 2 unscored Oct 8: 53 critical, 177 high, 245 medium, 25 low, 0 unscored; 5 added to CISA KEV Oct 9: 37 critical, 149 high, 114 medium, 18 low, 6 unscored Oct 10: 77 critical, 136 high, 189 medium, 10 low, 0 unscored Oct 11: 17 critical, 62 high, 141 medium, 14 low, 0 unscored Oct 12: 41 critical, 212 high, 372 medium, 47 low, 0 unscored Oct 13: 163 critical, 1357 high, 731 medium, 27 low, 1 unscored; 2 added to CISA KEV Oct 14: 73 critical, 324 high, 365 medium, 40 low, 43 unscored; 4 added to CISA KEV Oct 15: 45 critical, 206 high, 280 medium, 15 low, 0 unscored; 1 added to CISA KEV Oct 16: 44 critical, 162 high, 228 medium, 20 low, 20 unscored; 2 added to CISA KEV Oct 17: 3 critical, 29 high, 53 medium, 5 low, 0 unscored Oct 18: 9 critical, 58 high, 76 medium, 9 low, 400 unscored Oct 19: 31 critical, 148 high, 240 medium, 33 low, 0 unscored Oct 20: 173 critical, 813 high, 831 medium, 117 low, 0 unscored; 6 added to CISA KEV Oct 21: 50 critical, 211 high, 249 medium, 39 low, 1 unscored Oct 22: 62 critical, 159 high, 152 medium, 29 low, 2 unscored Oct 23: 37 critical, 159 high, 102 medium, 24 low, 170 unscored; 2 added to CISA KEV Oct 24: 11 critical, 23 high, 35 medium, 5 low, 2 unscored Oct 25: 3 critical, 32 high, 67 medium, 31 low, 0 unscored Oct 26: 38 critical, 252 high, 404 medium, 56 low, 14 unscored; 2 added to CISA KEV Oct 27: 88 critical, 303 high, 207 medium, 26 low, 0 unscored; 2 added to CISA KEV Oct 28: 39 critical, 239 high, 262 medium, 35 low, 89 unscored; 2 added to CISA KEV Oct 29: 85 critical, 200 high, 232 medium, 28 low, 2 unscored; 2 added to CISA KEV Oct 30: 50 critical, 224 high, 272 medium, 27 low, 4 unscored; 2 added to CISA KEV Oct 31: 12 critical, 45 high, 54 medium, 1 low, 1 unscored Nov 1: 26 critical, 17 high, 46 medium, 11 low, 2 unscored Nov 2: 35 critical, 211 high, 193 medium, 16 low, 18 unscored Nov 3: 63 critical, 261 high, 324 medium, 38 low, 87 unscored; 1 added to CISA KEV Nov 4: 42 critical, 152 high, 152 medium, 33 low, 34 unscored; 1 added to CISA KEV Nov 5: 39 critical, 166 high, 127 medium, 18 low, 80 unscored Nov 6: 40 critical, 135 high, 215 medium, 42 low, 28 unscored; 1 added to CISA KEV Nov 7: 67 critical, 149 high, 231 medium, 9 low, 17 unscored Nov 8: 20 critical, 85 high, 169 medium, 28 low, 0 unscored Nov 9: 1 critical, 2 high, 8 medium, 0 low, 0 unscored Sep 14 Sep 28 Oct 12 Oct 26 today
New vulnerabilities per day for the last 63 days by severity, 33,070 in all, and 74 added to CISA KEV.

Just added to CISA KEV

CISA confirms these are being exploited in the wild. Federal agencies get a deadline to patch; you should treat them the same way.

all known exploited
  1. 7.5
     CVE-2026-19868 An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authenticati…
  2. 5.5
     CVE-2024-27834 The issue was addressed with improved checks.
  3. 8.1
     CVE-2026-119977 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
  4. 4.3
     CVE-2026-118527 Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to uploa…
  5. 7.0
     CVE-2026-111357 Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege…
  6. 10.0
     CVE-2026-97229 Integer Overflow or Wraparound in GitLab

Plug it into anything

The same entries as a feed, a JSON API, an MCP server and a lockfile check. No account and no API key.

~ fencer-vulns
$ curl -s "https://vulns.fencer.dev/feed?filter=critical" 
<rss version="2.0">
  <channel><title>Fencer Vulns — Critical</title>
    <item>
      <title>CVE-2026-19868: An authentication enforcement vulnerability i...</title>
      <link>https://vulns.fencer.dev/CVE-2026-19868</link>
$ curl -s https://vulns.fencer.dev/api/v1/entries/CVE-2026-19868 
{
  "id": "CVE-2026-19868",
  "title": "An authentication enforcement vulnerability in SonicOS SS...",
  "severity": "high",
  "cvss": {
    "score": 7.5,
    "version": "3.1"
  },
  "kev": {
    "added": "2026-11-06"
  },
  "epss": {
    "score": 0.0062
  },
  "exploits": []
}
$ claude mcp add --transport http fencer-vulns https://vulns.fencer.dev/mcp 
# tools: search, get_vulnerability, list_feed, check_stack
# your agent checks a package before it installs it
$ curl -s -F lockfile=@package-lock.json https://vulns.fencer.dev/api/v1/stack 
# every advisory for the versions you pin, exploited first
# the report has its own feed for new matches

All · Express

Newest first. Every view here is also a feed.

  1. 4.0
    CVE-2024-10491 Preload arbitrary resources by injecting additional `Link` headers
    Expressnpm
  2. 4.7
    CVE-2024-9266 Open Redirect
    Expressnpm
  3. 5.0
    CVE-2024-43796 express vulnerable to XSS via response.redirect()
    Expressnpm
  4. 6.1
    CVE-2024-29041 Express.js Open Redirect in malformed URLs
    Expressnpm
  5. 7.5
    CVE-2022-24999 qs vulnerable to Prototype Pollution
    Expressnpm
    EPSS 15.7% chance of exploitation in 30 days, percentile 96%
  6. 6.1
    CVE-2014-6393 No Charset in Content-Type Header in express
    Expressnpm
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%